Phishing Scam Hits Twitter Again

What’s Phishing?

by: Jamie Dolan
2009-11-26
22:59:30

Phishing is a term used to describe a process that a criminal uses to illegally obtain information such as personal data or passwords. Phishing scams range from easily detectable attempts at obtaining your information to elaborate deception. Twitter users have been hit by Phishing scams in the past. Today, on Thanksgiving day, a number of “Direct Messages” have been sent out that contain a web site that is a Phishing site. This Phishing scam used a number of tactics to disguise there true purpose and to look legitimate. Understanding these tactics will help prevent you from becoming a victim in the future. Today’s attack used the following tactics:

1. They broke into the account of real twitter users.  Several of the users that I received Phishing messages from where very legitimate users, who I know did not send these messages.  Using these accounts makes the Phishing message look legitimate, and causes users to open a link they might not otherwise click.
2. The message contained a shortened URL that disguised the true identity of the site it went to.  Unfortunately, this is very common on twitter due to the limits of the length of messages, so you would not normally suspect that a shortened url is a fraud.
3. The web site that the link sent you to, contained the name Twitter in the address bar.  This can be very confusing, and lead you to believe that the web site is the real twitter site.
4. The web site was an exact copy of the twitter log-in page, the graphics and log-in box were exact copies of the twitter site.

What happens is this:

1. You receive a message from someone on your contact list who you trust, something to the effect, check out this great new site I found…
2. Knowing this person, you decide to click on the site.
3. A new web page opens, and you see the main twitter screen, you need to log-in again for some reason. (This is the Phishing site).
4. You enter your log-in information.
5. The Phishing web site now has your log-in name, password and full access to your Twitter account.

The operator of the Phishing site continues to obtain the log-in names and passwords of legitimates Twitter users, and then in turn logs in with the accounts and sends out more Phishing attempts.

To avoid becoming a victim, you should always make sure that the address in your web browser is that of the real site.  It will always end with twitter.com.  When you are at the real Twitter site, the main page will look like this: http://twitter.com/ in your browser.

If you do realize that you have entered your information on a Phishing web site, you should immediately change your twitter password.  If your unable to access your account to change your password, you should contact Twitter support for further assistance.

Please contact me or leave a comment with any questions.

Regards,

Jamie Dolan